Practical Law

As student life reclines into the summer holidays, two recent cases will be of significant interest to academic and qualification institutions and examination candidates.

In Nowak v Data Protection Commissioner (Case C-434/16), on a referral from the Irish Supreme Court Advocate, Advocate General Kokott (AG) delivered her opinion to the effect that a candidate’s handwritten examination script and the examiner’s corrections on it constitute the candidate’s personal data within the meaning of Article 2(a) of the Data Protection Directive (95/46/EC). The AG considered that an examination script constituted a collection of personal data on account, amongst other factors, of it being a documentary record that an individual has taken part in an exam and how they performed, and which may display their handwriting. Whilst it was not particularly significant whether the exam in question required a candidate’s composed response or a multiple choice answer, the AG considered that “the extent of the link between an examination candidate and his performance in an examination increases according to the extent to which he has to formulate the answers himself”. The main statutes in the Republic of Ireland dealing with data protection are the Data Protection Act 1988 and the Data Protection (Amendment) Act 2003, which brought it into line with the Data Protection Directive and, although special rules apply, candidates can obtain their examination results by way of a data subject access request (SAR). For further information, see Legal update, Advocate General opinion on whether handwritten exam scripts are personal data.

In the UK, the Data Protection Act 1998 (DPA 1998) permits a candidate to access, by way of a SAR, their mark (paragraph 8, Schedule 7, DPA), comments written by the examiner and minutes of any examination appeals panel. It specifically excludes exam scripts from being available by way of a SAR, however (Schedule 7, section 9) and so the AG’s opinion in Nowak, if it is followed by the ECJ, may represent a departure from the DPA and the Information Commissioner’s (IC) guidance and permit candidates to obtain these. For further information on the DPA 1998 generally, see Practice note, Overview of UK data protection regime.

Of more comfort to examination setting bodies , however, will be a recent IC decision notice (FS50661288) in relation to the Freedom of Information Act 2000 (FOIA) which held that the University of Durham did not have to disclose requested information relating to its 11+ examination, including the raw scores from test results. The university’s Centre for Evaluation and Monitoring was one of two leading commercial providers of 11+ testing, which it had invested significantly in. Selective secondary schools used the test to choose their intake of pupils. The university withheld some of the information under the exemption in section 43(2) of FOIA (prejudice to commercial interests). One of the test’s unique selling points was that it was significantly resistant to tutoring; the university argued that disclosure of raw test results to competitors and tutors would permit reverse engineering, the results of which would undermine this. The IC agreed that the exemption was engaged, and that the public interest favoured maintaining the exemption partly on account of detriment to the university’s revenue ultimately compromising its ability to pursue its core functions and this being of detriment to the public purse.

The decision followed a similar earlier decision by the IC in respect of the university’s 11+ raw test scores, which was upheld by the First-tier Tribunal (Information Rights) in 2016 (see Legal update, Information Tribunal ruling on FOIA commercial interest exemption and school test results). Not many examination bodies will be in the same position as the university was in this case, however, and this presents an interesting but exceptional application of FOIA to examination results.

Academic institutions regularly publish aggregated results and outcomes, on an anonymous basis, though this will depend on the type of institution; local authority maintained schools, for example, are required to do so. Anonymous data is not subject to the principles of the Data Protection Directive. The IC’s Guidance on Publication of exam results by schools recognises that the DPA 1998 does not preclude schools’ publication of individuals’ unanonymised exam results but that a school must not do so if a candidate objects without justification, and processing must, as ever, be fair.

In 2009, in another IC decision which involved the 11+ exam (FS50160381), the IC held that Buckinghamshire County Council could apply section 40 of FOIA (personal information) to withhold anonymised data concerning the numbers of candidates passing the exam, amongst other data, only where the number was less than five; the IC considered that data denoting under five candidates might reveal individuals’ identities and, if disclosed, breach the first data protection principle of the DPA.

In FS50544323, however, the IC permitted the University of London to withhold anonymised information concerning the number of candidates sitting, passing and failing two modules on its Bar Professional Training Course under section 36(2)(c) of FOIA (prejudice to the conduct of public affairs). That the data was anonymised was not a material issue. The Bar Standards Board (BSB) accredited the course, and the parties’ accreditation agreement stated that all information arising from the agreement was to be treated confidentially. The IC considered that the public interest weighed in favour of maintaining the exemption given that the BSB intended to publish the information in any event and the data related only to a small portion of the course’s syllabus, so served a limited public interest benefit. For further information on FOIA generally, see Practice note, Freedom of information.

Examination results are often a sensitive issue, and the DPA 1998 does provide some recognition of this, which is reflected in the IC’s guidance. It is also interesting to take stock of the variable treatment of examination result data under FOIA in what is becoming an increasingly competitive and commercialised sector. Further, if the ECJ’s decision in Nowak follows the AG’s Opinion there may yet be a flurry of data subject access requests from candidates for copies of their examination scripts. Academic and qualification institutions may find this a testing time.